Solved

Tracking a user

Posted on 2001-06-27
10
549 Views
Last Modified: 2010-04-21
Is there a way in unix to track what a user is doing while logged in? Is there an account monitoriing option to flip on for a user's account, or is there a unix application that can monitor online activity (as in tracking what commands a user is executing)?
0
Comment
Question by:dgiessen
10 Comments
 
LVL 5

Expert Comment

by:Nisus091197
ID: 6233278
You can keep an eye on their shell history file, e.g. .history or .sh_history

You can also setup system accounting using sac.

What OS are you using and what shell is your user using?

If they do not need much access you can give them a menu system of the commands they need or else setup a restricted shell for them.

Regards, Nisus
http://www.omnimodo.com
0
 
LVL 3

Expert Comment

by:interiot
ID: 6233335
ttysnoop is a program that allows you (once you configure things correctly) to view a user's text terminal, just as if you were looking at their screen.

lsof (or other variants depending on the OS) is a program that allows you to view the files that are currently open, and you can specify certain users to look at.  It might take a little detective work, but you can still figure out what the user is doing.
0
 
LVL 3

Expert Comment

by:mrn060900
ID: 6237028
You could also use script ( see script man page) It just copies everything they see/type to a log file, but be warned the logs can get huge.

Regards Mike
0
 
LVL 51

Expert Comment

by:ahoffmann
ID: 6241193
most UNIX have the last and lastcomm command
lastcomm requires accounting being configured
0
 
LVL 3

Accepted Solution

by:
interiot earned 50 total points
ID: 6241236
script and .history run in the user's account, so users with evil intent can turn them off before doing anything incriminating.

lastcomm only logs which programs are run, not what is typed.

ttysnoop can't be stopped by the user, and it allows the system administrator to watch (and type things into) the user's terminal in real time, and allows logging.

   http://www.linuxhelp.net/guides/djg/ttysnoop.phtml
   http://www.apart.net/ttysnoop/index-0.7.html
0
Is Your Active Directory as Secure as You Think?

More than 75% of all records are compromised because of the loss or theft of a privileged credential. Experts have been exploring Active Directory infrastructure to identify key threats and establish best practices for keeping data safe. Attend this month’s webinar to learn more.

 
LVL 5

Expert Comment

by:paulqna
ID: 6248038
within the "top" command you can specify a specific user.

of try the "w" command.
0
 
LVL 1

Expert Comment

by:haeger
ID: 6517098
Hi.
Here's a small program that I found useful from time to time.
http://filewatcher.org/sec/ttysnoop/int_1week.html
Lots of debian there but I know for a fact that it works on other platforms as well.
Watch the user in realtime or just redirect stdin to a file of your choice.

0
 
LVL 1

Expert Comment

by:haeger
ID: 6517100
Hi.
Here's a small program that I found useful from time to time.
http://filewatcher.org/sec/ttysnoop/int_1week.html
Lots of debian there but I know for a fact that it works on other platforms as well.
Watch the user in realtime or just redirect stdin to a file of your choice.

0
 
LVL 20

Expert Comment

by:tfewster
ID: 7705206
No comment has been added lately, so it's time to clean up this TA.
I will leave a recommendation for this question in the Cleanup topic area as follows:
- Answered by interiot

Please leave any comments here within the next 7 days

PLEASE DO NOT ACCEPT THIS COMMENT AS AN ANSWER !

tfewster (I don't work here, I'm just an Expert :-)
0
 

Expert Comment

by:modulo
ID: 7757496
Finalized as proposed

modulo

Community Support Moderator
Experts Exchange
0

Featured Post

Is Your Active Directory as Secure as You Think?

More than 75% of all records are compromised because of the loss or theft of a privileged credential. Experts have been exploring Active Directory infrastructure to identify key threats and establish best practices for keeping data safe. Attend this month’s webinar to learn more.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
non-interactive authentication of sftp command in AIX 5.3 15 187
Red Hat Enterprise Linux 6.5 gets missing "/lib/ld-linux.so.2" 7 70
Unix Question 19 44
Image not there 4 44
I have been running these systems for a few years now and I am just very happy with them.   I just wanted to share the manual that I have created for upgrades and other things.  Oooh yes! FreeBSD makes me happy (as a server), no maintenance and I al…
Every server (virtual or physical) needs a console: and the console can be provided through hardware directly connected, software for remote connections, local connections, through a KVM, etc. This document explains the different types of consol…
Learn how to get help with Linux/Unix bash shell commands. Use help to read help documents for built in bash shell commands.: Use man to interface with the online reference manuals for shell commands.: Use man to search man pages for unknown command…
In a previous video, we went over how to export a DynamoDB table into Amazon S3.  In this video, we show how to load the export from S3 into a DynamoDB table.

910 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

20 Experts available now in Live!

Get 1:1 Help Now